Binance's $6.3B Hack Raises Hard Questions on Hot Wallet Controls

Binance's $6.3 billion security incident has left the industry guessing at what actually constrained the attackers: the exchange's internal signing controls, which no public record can verify. Binance co-CEO Richard Teng confirmed on Oct. 30 that the attack hit the exchange's own hot wallet, while most customer assets sat in offline cold storage and moved to hot wallets only when users requested withdrawals.

In its initial report Tuesday, Binance said attackers compromised an internal wallet-signing service to move funds outside the normal withdrawal process. The exchange withheld some technical details to prevent follow-on attacks and did not respond to Cointelegraph's questions about wallet balances and safeguards.

Rivals moved quickly to differentiate. Coinbase, Gate and Upbit have all disclosed their cold-storage ratios since the incident.

What can blockchain records actually prove?

CertiK analyst Jonathan Riss told Cointelegraph that the $6.3 billion figure represents the cumulative value of assets affected across 10 blockchains. On Ethereum, attackers repeatedly drained a hot wallet as fresh deposits arrived.

That pattern matters. When attackers hold valid signatures, their potential access depends on what the signing system lets them transfer over time — a wallet's balance at any single moment doesn't capture that exposure.

Transaction limits enforced by the application requesting a signature can be bypassed if that application itself is compromised, Riss said. Limits enforced independently by the signing system, by contrast, may still hold.

Cross-exchange comparisons hit the same wall. "A comparison with other exchanges isn't really possible from the outside," Riss said. "Public information on internal signing architecture is limited everywhere, and reserve distribution and proof-of-reserves attestations show what sits where, not how a withdrawal is authorized."

Eugene Hahr, chief product officer at custody firm BitGo, declined to speculate. "The breakdown of custody arrangements is a question Binance is best placed to answer," he said.

How much belongs in a hot wallet?

Idan Ofrat, co-founder and chief product officer at Fireblocks, said exchanges typically keep only enough in hot wallets to cover a few days of expected withdrawals — often a low single-digit percentage of assets under management. Most hold the bulk of customer funds in cold storage, and some route transfers through intermediate wallets that require manual approval before funds reach hot wallets.

Alex Tobol, chief technology officer at Telegram-based wallet Walt, said holding billions in hot wallets isn't inherently unusual for an exchange of Binance's scale. Hot wallets generally process withdrawals automatically, he said, but replenishing them from cold storage should require a separate treasury decision and manual sign-off.

Hahr pointed to the controls that matter when a system is already compromised: limits applied before signing, approved withdrawal address lists, and additional authorization requirements can all contain losses.

The operational takeaway for the market is blunt. Proof-of-reserves attestations — now the industry's standard transparency tool — reveal where assets sit, not how a withdrawal gets authorized. Until Binance discloses more about its signing architecture, the effectiveness of its safeguards remains an open question, and pressure for standardized custody disclosures will keep building.